miam 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (21) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +24 -2
  3. data/bin/miam +5 -4
  4. data/lib/miam.rb +1 -0
  5. data/lib/miam/client.rb +129 -6
  6. data/lib/miam/driver.rb +100 -0
  7. data/lib/miam/dsl/context.rb +22 -1
  8. data/lib/miam/dsl/context/group.rb +3 -3
  9. data/lib/miam/dsl/context/role.rb +51 -0
  10. data/lib/miam/dsl/context/user.rb +3 -3
  11. data/lib/miam/dsl/converter.rb +58 -0
  12. data/lib/miam/exporter.rb +95 -2
  13. data/lib/miam/logger.rb +4 -5
  14. data/lib/miam/password_manager.rb +4 -0
  15. data/lib/miam/version.rb +1 -1
  16. data/spec/miam/create_spec.rb +47 -3
  17. data/spec/miam/delete_spec.rb +321 -1
  18. data/spec/miam/rename_spec.rb +208 -1
  19. data/spec/miam/update_spec.rb +452 -1
  20. data/spec/spec_helper.rb +4 -3
  21. metadata +3 -2
data/spec/miam/rename_spec.rb CHANGED
@@ -42,6 +42,32 @@ describe 'update' do
42
42
  [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
43
43
  end
44
44
  end
45
+
46
+ role "my-role", :path=>"/any/" do
47
+ instance_profiles(
48
+ "my-instance-profile"
49
+ )
50
+
51
+ assume_role_policy_document do
52
+ {"Version"=>"2012-10-17",
53
+ "Statement"=>
54
+ [{"Sid"=>"",
55
+ "Effect"=>"Allow",
56
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
57
+ "Action"=>"sts:AssumeRole"}]}
58
+ end
59
+
60
+ policy "role-policy" do
61
+ {"Statement"=>
62
+ [{"Action"=>
63
+ ["s3:Get*",
64
+ "s3:List*"],
65
+ "Effect"=>"Allow",
66
+ "Resource"=>"*"}]}
67
+ end
68
+ end
69
+
70
+ instance_profile "my-instance-profile", :path=>"/profile/"
45
71
  RUBY
46
72
  end
47
73
 
@@ -79,7 +105,25 @@ describe 'update' do
79
105
  {"Statement"=>
80
106
  [{"Effect"=>"Allow",
81
107
  "Action"=>"ses:SendRawEmail",
82
- "Resource"=>"*"}]}}}}}
108
+ "Resource"=>"*"}]}}}},
109
+ :roles=>
110
+ {"my-role"=>
111
+ {:path=>"/any/",
112
+ :assume_role_policy_document=>
113
+ {"Version"=>"2012-10-17",
114
+ "Statement"=>
115
+ [{"Sid"=>"",
116
+ "Effect"=>"Allow",
117
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
118
+ "Action"=>"sts:AssumeRole"}]},
119
+ :instance_profiles=>["my-instance-profile"],
120
+ :policies=>
121
+ {"role-policy"=>
122
+ {"Statement"=>
123
+ [{"Action"=>["s3:Get*", "s3:List*"],
124
+ "Effect"=>"Allow",
125
+ "Resource"=>"*"}]}}}},
126
+ :instance_profiles=>{"my-instance-profile"=>{:path=>"/profile/"}}}
83
127
  end
84
128
 
85
129
  before(:each) do
@@ -130,6 +174,32 @@ describe 'update' do
130
174
  [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
131
175
  end
132
176
  end
177
+
178
+ role "my-role", :path=>"/any/" do
179
+ instance_profiles(
180
+ "my-instance-profile"
181
+ )
182
+
183
+ assume_role_policy_document do
184
+ {"Version"=>"2012-10-17",
185
+ "Statement"=>
186
+ [{"Sid"=>"",
187
+ "Effect"=>"Allow",
188
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
189
+ "Action"=>"sts:AssumeRole"}]}
190
+ end
191
+
192
+ policy "role-policy" do
193
+ {"Statement"=>
194
+ [{"Action"=>
195
+ ["s3:Get*",
196
+ "s3:List*"],
197
+ "Effect"=>"Allow",
198
+ "Resource"=>"*"}]}
199
+ end
200
+ end
201
+
202
+ instance_profile "my-instance-profile", :path=>"/profile/"
133
203
  RUBY
134
204
  end
135
205
 
@@ -187,6 +257,32 @@ describe 'update' do
187
257
  [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
188
258
  end
189
259
  end
260
+
261
+ role "my-role", :path=>"/any/" do
262
+ instance_profiles(
263
+ "my-instance-profile"
264
+ )
265
+
266
+ assume_role_policy_document do
267
+ {"Version"=>"2012-10-17",
268
+ "Statement"=>
269
+ [{"Sid"=>"",
270
+ "Effect"=>"Allow",
271
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
272
+ "Action"=>"sts:AssumeRole"}]}
273
+ end
274
+
275
+ policy "role-policy" do
276
+ {"Statement"=>
277
+ [{"Action"=>
278
+ ["s3:Get*",
279
+ "s3:List*"],
280
+ "Effect"=>"Allow",
281
+ "Resource"=>"*"}]}
282
+ end
283
+ end
284
+
285
+ instance_profile "my-instance-profile", :path=>"/profile/"
190
286
  RUBY
191
287
  end
192
288
 
@@ -245,6 +341,32 @@ describe 'update' do
245
341
  [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
246
342
  end
247
343
  end
344
+
345
+ role "my-role", :path=>"/any/" do
346
+ instance_profiles(
347
+ "my-instance-profile"
348
+ )
349
+
350
+ assume_role_policy_document do
351
+ {"Version"=>"2012-10-17",
352
+ "Statement"=>
353
+ [{"Sid"=>"",
354
+ "Effect"=>"Allow",
355
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
356
+ "Action"=>"sts:AssumeRole"}]}
357
+ end
358
+
359
+ policy "role-policy" do
360
+ {"Statement"=>
361
+ [{"Action"=>
362
+ ["s3:Get*",
363
+ "s3:List*"],
364
+ "Effect"=>"Allow",
365
+ "Resource"=>"*"}]}
366
+ end
367
+ end
368
+
369
+ instance_profile "my-instance-profile", :path=>"/profile/"
248
370
  RUBY
249
371
  end
250
372
 
@@ -259,4 +381,89 @@ describe 'update' do
259
381
  expect(export).to eq expected
260
382
  end
261
383
  end
384
+
385
+ context 'when rename role and instance_profile' do
386
+ let(:rename_role_and_instance_profile_dsl) do
387
+ <<-RUBY
388
+ user "bob", :path=>"/devloper/" do
389
+ login_profile :password_reset_required=>true
390
+
391
+ groups(
392
+ "Admin",
393
+ "SES"
394
+ )
395
+
396
+ policy "S3" do
397
+ {"Statement"=>
398
+ [{"Action"=>
399
+ ["s3:Get*",
400
+ "s3:List*"],
401
+ "Effect"=>"Allow",
402
+ "Resource"=>"*"}]}
403
+ end
404
+ end
405
+
406
+ user "mary", :path=>"/staff/" do
407
+ policy "S3" do
408
+ {"Statement"=>
409
+ [{"Action"=>
410
+ ["s3:Get*",
411
+ "s3:List*"],
412
+ "Effect"=>"Allow",
413
+ "Resource"=>"*"}]}
414
+ end
415
+ end
416
+
417
+ group "Admin", :path=>"/admin/" do
418
+ policy "Admin" do
419
+ {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
420
+ end
421
+ end
422
+
423
+ group "SES", :path=>"/ses/" do
424
+ policy "ses-policy" do
425
+ {"Statement"=>
426
+ [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
427
+ end
428
+ end
429
+
430
+ role "my-role2", :path=>"/any/" do
431
+ instance_profiles(
432
+ "my-instance-profile2"
433
+ )
434
+
435
+ assume_role_policy_document do
436
+ {"Version"=>"2012-10-17",
437
+ "Statement"=>
438
+ [{"Sid"=>"",
439
+ "Effect"=>"Allow",
440
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
441
+ "Action"=>"sts:AssumeRole"}]}
442
+ end
443
+
444
+ policy "role-policy" do
445
+ {"Statement"=>
446
+ [{"Action"=>
447
+ ["s3:Get*",
448
+ "s3:List*"],
449
+ "Effect"=>"Allow",
450
+ "Resource"=>"*"}]}
451
+ end
452
+ end
453
+
454
+ instance_profile "my-instance-profile2", :path=>"/profile/"
455
+ RUBY
456
+ end
457
+
458
+ subject { client }
459
+
460
+ it do
461
+ updated = apply(subject) { rename_role_and_instance_profile_dsl }
462
+ expect(updated).to be_truthy
463
+ expected[:roles]["my-role"][:instance_profiles] = ["my-instance-profile2"]
464
+ expected[:roles]["my-role2"] = expected[:roles].delete("my-role")
465
+ expected[:instance_profiles]["my-instance-profile2"] = expected[:instance_profiles].delete("my-instance-profile")
466
+ expect(export).to eq expected
467
+ end
468
+ end
262
469
  end
data/spec/miam/update_spec.rb CHANGED
@@ -42,6 +42,32 @@ describe 'update' do
42
42
  [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
43
43
  end
44
44
  end
45
+
46
+ role "my-role", :path=>"/any/" do
47
+ instance_profiles(
48
+ "my-instance-profile"
49
+ )
50
+
51
+ assume_role_policy_document do
52
+ {"Version"=>"2012-10-17",
53
+ "Statement"=>
54
+ [{"Sid"=>"",
55
+ "Effect"=>"Allow",
56
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
57
+ "Action"=>"sts:AssumeRole"}]}
58
+ end
59
+
60
+ policy "role-policy" do
61
+ {"Statement"=>
62
+ [{"Action"=>
63
+ ["s3:Get*",
64
+ "s3:List*"],
65
+ "Effect"=>"Allow",
66
+ "Resource"=>"*"}]}
67
+ end
68
+ end
69
+
70
+ instance_profile "my-instance-profile", :path=>"/profile/"
45
71
  RUBY
46
72
  end
47
73
 
@@ -79,7 +105,25 @@ describe 'update' do
79
105
  {"Statement"=>
80
106
  [{"Effect"=>"Allow",
81
107
  "Action"=>"ses:SendRawEmail",
82
- "Resource"=>"*"}]}}}}}
108
+ "Resource"=>"*"}]}}}},
109
+ :roles=>
110
+ {"my-role"=>
111
+ {:path=>"/any/",
112
+ :assume_role_policy_document=>
113
+ {"Version"=>"2012-10-17",
114
+ "Statement"=>
115
+ [{"Sid"=>"",
116
+ "Effect"=>"Allow",
117
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
118
+ "Action"=>"sts:AssumeRole"}]},
119
+ :instance_profiles=>["my-instance-profile"],
120
+ :policies=>
121
+ {"role-policy"=>
122
+ {"Statement"=>
123
+ [{"Action"=>["s3:Get*", "s3:List*"],
124
+ "Effect"=>"Allow",
125
+ "Resource"=>"*"}]}}}},
126
+ :instance_profiles=>{"my-instance-profile"=>{:path=>"/profile/"}}}
83
127
  end
84
128
 
85
129
  before(:each) do
@@ -141,6 +185,33 @@ describe 'update' do
141
185
  [{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
142
186
  end
143
187
  end
188
+
189
+ role "my-role", :path=>"/any/" do
190
+ instance_profiles(
191
+ "my-instance-profile"
192
+ )
193
+
194
+ assume_role_policy_document do
195
+ {"Version"=>"2012-10-17",
196
+ "Statement"=>
197
+ [{"Sid"=>"",
198
+ "Effect"=>"Allow",
199
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
200
+ "Action"=>"sts:AssumeRole"}]}
201
+ end
202
+
203
+ policy "role-policy" do
204
+ {"Statement"=>
205
+ [{"Action"=>
206
+ ["s3:Get*",
207
+ "s3:Put*",
208
+ "s3:List*"],
209
+ "Effect"=>"Allow",
210
+ "Resource"=>"*"}]}
211
+ end
212
+ end
213
+
214
+ instance_profile "my-instance-profile", :path=>"/profile/"
144
215
  RUBY
145
216
  end
146
217
 
@@ -151,6 +222,7 @@ describe 'update' do
151
222
  expect(updated).to be_truthy
152
223
  expected[:users]["mary"][:policies]["S3"]["Statement"][0]["Action"] = ["s3:Get*", "s3:Put*", "s3:List*"]
153
224
  expected[:groups]["SES"][:policies]["ses-policy"]["Statement"][0]["Action"] = "*"
225
+ expected[:roles]["my-role"][:policies]["role-policy"]["Statement"][0]["Action"] = ["s3:Get*", "s3:Put*", "s3:List*"]
154
226
  expect(export).to eq expected
155
227
  end
156
228
  end
@@ -199,6 +271,32 @@ describe 'update' do
199
271
  [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
200
272
  end
201
273
  end
274
+
275
+ role "my-role", :path=>"/any/" do
276
+ instance_profiles(
277
+ "my-instance-profile"
278
+ )
279
+
280
+ assume_role_policy_document do
281
+ {"Version"=>"2012-10-17",
282
+ "Statement"=>
283
+ [{"Sid"=>"",
284
+ "Effect"=>"Allow",
285
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
286
+ "Action"=>"sts:AssumeRole"}]}
287
+ end
288
+
289
+ policy "role-policy" do
290
+ {"Statement"=>
291
+ [{"Action"=>
292
+ ["s3:Get*",
293
+ "s3:List*"],
294
+ "Effect"=>"Allow",
295
+ "Resource"=>"*"}]}
296
+ end
297
+ end
298
+
299
+ instance_profile "my-instance-profile", :path=>"/profile/"
202
300
  RUBY
203
301
  end
204
302
 
@@ -213,6 +311,178 @@ describe 'update' do
213
311
  end
214
312
  end
215
313
 
314
+ context 'when update path (role, instance_profile)' do
315
+ let(:cannot_update_path_dsl) do
316
+ <<-RUBY
317
+ user "bob", :path=>"/devloper/" do
318
+ login_profile :password_reset_required=>true
319
+
320
+ groups(
321
+ "Admin",
322
+ "SES"
323
+ )
324
+
325
+ policy "S3" do
326
+ {"Statement"=>
327
+ [{"Action"=>
328
+ ["s3:Get*",
329
+ "s3:List*"],
330
+ "Effect"=>"Allow",
331
+ "Resource"=>"*"}]}
332
+ end
333
+ end
334
+
335
+ user "mary", :path=>"/staff/" do
336
+ policy "S3" do
337
+ {"Statement"=>
338
+ [{"Action"=>
339
+ ["s3:Get*",
340
+ "s3:List*"],
341
+ "Effect"=>"Allow",
342
+ "Resource"=>"*"}]}
343
+ end
344
+ end
345
+
346
+ group "Admin", :path=>"/admin/" do
347
+ policy "Admin" do
348
+ {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
349
+ end
350
+ end
351
+
352
+ group "SES", :path=>"/ses/" do
353
+ policy "ses-policy" do
354
+ {"Statement"=>
355
+ [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
356
+ end
357
+ end
358
+
359
+ role "my-role", :path=>"/any/xxx/" do
360
+ instance_profiles(
361
+ "my-instance-profile"
362
+ )
363
+
364
+ assume_role_policy_document do
365
+ {"Version"=>"2012-10-17",
366
+ "Statement"=>
367
+ [{"Sid"=>"",
368
+ "Effect"=>"Allow",
369
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
370
+ "Action"=>"sts:AssumeRole"}]}
371
+ end
372
+
373
+ policy "role-policy" do
374
+ {"Statement"=>
375
+ [{"Action"=>
376
+ ["s3:Get*",
377
+ "s3:List*"],
378
+ "Effect"=>"Allow",
379
+ "Resource"=>"*"}]}
380
+ end
381
+ end
382
+
383
+ instance_profile "my-instance-profile", :path=>"/profile/xxx/"
384
+ RUBY
385
+ end
386
+
387
+ let(:logger) do
388
+ logger = Logger.new('/dev/null')
389
+ expect(logger).to receive(:warn).with("[WARN] Role `my-role`: 'path' cannot be updated")
390
+ expect(logger).to receive(:warn).with("[WARN] InstanceProfile `my-instance-profile`: 'path' cannot be updated")
391
+ logger
392
+ end
393
+
394
+ subject { client(logger: logger) }
395
+
396
+ it do
397
+ updated = apply(subject) { cannot_update_path_dsl }
398
+ expect(updated).to be_falsey
399
+ expect(export).to eq expected
400
+ end
401
+ end
402
+
403
+ context 'when update assume_role_policy' do
404
+ let(:update_assume_role_policy_dsl) do
405
+ <<-RUBY
406
+ user "bob", :path=>"/devloper/" do
407
+ login_profile :password_reset_required=>true
408
+
409
+ groups(
410
+ "Admin",
411
+ "SES"
412
+ )
413
+
414
+ policy "S3" do
415
+ {"Statement"=>
416
+ [{"Action"=>
417
+ ["s3:Get*",
418
+ "s3:List*"],
419
+ "Effect"=>"Allow",
420
+ "Resource"=>"*"}]}
421
+ end
422
+ end
423
+
424
+ user "mary", :path=>"/staff/" do
425
+ policy "S3" do
426
+ {"Statement"=>
427
+ [{"Action"=>
428
+ ["s3:Get*",
429
+ "s3:List*"],
430
+ "Effect"=>"Allow",
431
+ "Resource"=>"*"}]}
432
+ end
433
+ end
434
+
435
+ group "Admin", :path=>"/admin/" do
436
+ policy "Admin" do
437
+ {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
438
+ end
439
+ end
440
+
441
+ group "SES", :path=>"/ses/" do
442
+ policy "ses-policy" do
443
+ {"Statement"=>
444
+ [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
445
+ end
446
+ end
447
+
448
+ role "my-role", :path=>"/any/" do
449
+ instance_profiles(
450
+ "my-instance-profile"
451
+ )
452
+
453
+ assume_role_policy_document do
454
+ {"Version"=>"2012-10-17",
455
+ "Statement"=>
456
+ [{"Sid"=>"SID",
457
+ "Effect"=>"Allow",
458
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
459
+ "Action"=>"sts:AssumeRole"}]}
460
+ end
461
+
462
+ policy "role-policy" do
463
+ {"Statement"=>
464
+ [{"Action"=>
465
+ ["s3:Get*",
466
+ "s3:List*"],
467
+ "Effect"=>"Allow",
468
+ "Resource"=>"*"}]}
469
+ end
470
+ end
471
+
472
+ instance_profile "my-instance-profile", :path=>"/profile/"
473
+ RUBY
474
+ end
475
+
476
+ subject { client }
477
+
478
+ it do
479
+ updated = apply(subject) { update_assume_role_policy_dsl }
480
+ expect(updated).to be_truthy
481
+ expected[:roles]["my-role"][:assume_role_policy_document]["Statement"][0]["Sid"] = "SID"
482
+ expect(export).to eq expected
483
+ end
484
+ end
485
+
216
486
  context 'when update groups' do
217
487
  let(:update_groups_dsl) do
218
488
  <<-RUBY
@@ -261,6 +531,32 @@ describe 'update' do
261
531
  [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
262
532
  end
263
533
  end
534
+
535
+ role "my-role", :path=>"/any/" do
536
+ instance_profiles(
537
+ "my-instance-profile"
538
+ )
539
+
540
+ assume_role_policy_document do
541
+ {"Version"=>"2012-10-17",
542
+ "Statement"=>
543
+ [{"Sid"=>"",
544
+ "Effect"=>"Allow",
545
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
546
+ "Action"=>"sts:AssumeRole"}]}
547
+ end
548
+
549
+ policy "role-policy" do
550
+ {"Statement"=>
551
+ [{"Action"=>
552
+ ["s3:Get*",
553
+ "s3:List*"],
554
+ "Effect"=>"Allow",
555
+ "Resource"=>"*"}]}
556
+ end
557
+ end
558
+
559
+ instance_profile "my-instance-profile", :path=>"/profile/"
264
560
  RUBY
265
561
  end
266
562
 
@@ -319,6 +615,32 @@ describe 'update' do
319
615
  [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
320
616
  end
321
617
  end
618
+
619
+ role "my-role", :path=>"/any/" do
620
+ instance_profiles(
621
+ "my-instance-profile"
622
+ )
623
+
624
+ assume_role_policy_document do
625
+ {"Version"=>"2012-10-17",
626
+ "Statement"=>
627
+ [{"Sid"=>"",
628
+ "Effect"=>"Allow",
629
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
630
+ "Action"=>"sts:AssumeRole"}]}
631
+ end
632
+
633
+ policy "role-policy" do
634
+ {"Statement"=>
635
+ [{"Action"=>
636
+ ["s3:Get*",
637
+ "s3:List*"],
638
+ "Effect"=>"Allow",
639
+ "Resource"=>"*"}]}
640
+ end
641
+ end
642
+
643
+ instance_profile "my-instance-profile", :path=>"/profile/"
322
644
  RUBY
323
645
  end
324
646
 
@@ -374,6 +696,32 @@ describe 'update' do
374
696
  [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
375
697
  end
376
698
  end
699
+
700
+ role "my-role", :path=>"/any/" do
701
+ instance_profiles(
702
+ "my-instance-profile"
703
+ )
704
+
705
+ assume_role_policy_document do
706
+ {"Version"=>"2012-10-17",
707
+ "Statement"=>
708
+ [{"Sid"=>"",
709
+ "Effect"=>"Allow",
710
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
711
+ "Action"=>"sts:AssumeRole"}]}
712
+ end
713
+
714
+ policy "role-policy" do
715
+ {"Statement"=>
716
+ [{"Action"=>
717
+ ["s3:Get*",
718
+ "s3:List*"],
719
+ "Effect"=>"Allow",
720
+ "Resource"=>"*"}]}
721
+ end
722
+ end
723
+
724
+ instance_profile "my-instance-profile", :path=>"/profile/"
377
725
  RUBY
378
726
  end
379
727
 
@@ -418,6 +766,23 @@ describe 'update' do
418
766
 
419
767
  group "SES", :path=>"/ses/" do
420
768
  end
769
+
770
+ role "my-role", :path=>"/any/" do
771
+ instance_profiles(
772
+ "my-instance-profile"
773
+ )
774
+
775
+ assume_role_policy_document do
776
+ {"Version"=>"2012-10-17",
777
+ "Statement"=>
778
+ [{"Sid"=>"",
779
+ "Effect"=>"Allow",
780
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
781
+ "Action"=>"sts:AssumeRole"}]}
782
+ end
783
+ end
784
+
785
+ instance_profile "my-instance-profile", :path=>"/profile/"
421
786
  RUBY
422
787
  end
423
788
 
@@ -428,6 +793,92 @@ describe 'update' do
428
793
  expect(updated).to be_truthy
429
794
  expected[:users]["bob"][:policies].delete("S3")
430
795
  expected[:groups]["SES"][:policies].delete("ses-policy")
796
+ expected[:roles]["my-role"][:policies].delete("role-policy")
797
+ expect(export).to eq expected
798
+ end
799
+ end
800
+
801
+ context 'when update instance_profiles' do
802
+ let(:update_instance_profiles_dsl) do
803
+ <<-RUBY
804
+ user "bob", :path=>"/devloper/" do
805
+ login_profile :password_reset_required=>true
806
+
807
+ groups(
808
+ "Admin",
809
+ "SES"
810
+ )
811
+
812
+ policy "S3" do
813
+ {"Statement"=>
814
+ [{"Action"=>
815
+ ["s3:Get*",
816
+ "s3:List*"],
817
+ "Effect"=>"Allow",
818
+ "Resource"=>"*"}]}
819
+ end
820
+ end
821
+
822
+ user "mary", :path=>"/staff/" do
823
+ policy "S3" do
824
+ {"Statement"=>
825
+ [{"Action"=>
826
+ ["s3:Get*",
827
+ "s3:List*"],
828
+ "Effect"=>"Allow",
829
+ "Resource"=>"*"}]}
830
+ end
831
+ end
832
+
833
+ group "Admin", :path=>"/admin/" do
834
+ policy "Admin" do
835
+ {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
836
+ end
837
+ end
838
+
839
+ group "SES", :path=>"/ses/" do
840
+ policy "ses-policy" do
841
+ {"Statement"=>
842
+ [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
843
+ end
844
+ end
845
+
846
+ role "my-role", :path=>"/any/" do
847
+ instance_profiles(
848
+ "my-instance-profile2"
849
+ )
850
+
851
+ assume_role_policy_document do
852
+ {"Version"=>"2012-10-17",
853
+ "Statement"=>
854
+ [{"Sid"=>"",
855
+ "Effect"=>"Allow",
856
+ "Principal"=>{"Service"=>"ec2.amazonaws.com"},
857
+ "Action"=>"sts:AssumeRole"}]}
858
+ end
859
+
860
+ policy "role-policy" do
861
+ {"Statement"=>
862
+ [{"Action"=>
863
+ ["s3:Get*",
864
+ "s3:List*"],
865
+ "Effect"=>"Allow",
866
+ "Resource"=>"*"}]}
867
+ end
868
+ end
869
+
870
+ instance_profile "my-instance-profile", :path=>"/profile/"
871
+ instance_profile "my-instance-profile2", :path=>"/profile2/"
872
+ RUBY
873
+ end
874
+
875
+ subject { client }
876
+
877
+ it do
878
+ updated = apply(subject) { update_instance_profiles_dsl }
879
+ expect(updated).to be_truthy
880
+ expected[:roles]["my-role"][:instance_profiles] = ["my-instance-profile2"]
881
+ expected[:instance_profiles]["my-instance-profile2"] = {:path=>"/profile2/"}
431
882
  expect(export).to eq expected
432
883
  end
433
884
  end